I use an antimalware program- the scan finds a PUP (Potentially Unwanted Program), which is quarantined and removed. It comes back! I am guessing it is stored somehow to resurface after normal shut down and reboot. Where can this be hiding out? Someone suggested Google Drive? PUP's location in file says C User (my Wife) App Data Local Google Chrome User Data Default Extension then a string of random letters. It found this same instance 40 times of the same PUP on recent scan, but I thought this was taken care of when I first found this along time ago. I can find the same string of letters if I search verbatim in Google search. Google Forum said: I'd recommend running a scan on your computer with a trusted anti-virus software. If the scan detects any suspicious programs or applications, remove them immediately. Which is what I have done over and over..
If the program is in Google Chrome's User App Data folder, it is probably being downloaded as a temporary internet file. Every Time a user browses a website, the page is downloaded to that folder. So either your wife has downloaded multiple versions of a malicious file, or she keeps going to the same page to download the PUP. To eliminate the possibility there are just a lot of instances of the file, try deleting Google's entire folder in App Data and restarting the browser.
Other more advanced techniques could include a root kit, or a malicious version of chrome, but these are less likely.